CVE-2021-24872

MEDIUM 6.5CVE-2021-24872 · Published 13/12/2021 · updated 17/06/2026

In short

CVE-2021-24872 is a MEDIUM (CVSS 6.5) vulnerability affecting get custom field values (get custom field values project).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.8% of all vulnerabilities.
Fix: update to 4.0 or later.

Package	Affected versions	Patched versions
get custom field values get_custom_field_values_project	`< 4.0`	`4.0`

Description

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

References

wpscan.com/vulnerability/ec23734a-5ea7-4e46-aba9-3dee4e6dffb6 · Exploit

More vulnerabilities in get custom field values

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free